Transaction on your Site; Possible Fraud

You guys know everything about computers and beyond.

I got 3 emails like this from my Site, from the same person, where I provide
Music Downloads for sale at 99 cents per:

Error code 506. Possible fraud. Error with REMOTE IP ADDRESS =
66.211.180.66.
The remote address of the script posting to this
notify script does not match a valid PayPal ip address

These are the valid IP Addresses:
66.211.169.65,66.212.168.97,215.113.188.35,216.114.188.65,

The Order ID received was: d023e749e8dec1fg6e528da24e13182a

Does anyone know what this means? Incidentally I got a vibe to change these
IP #'s slightly, but if need be I'll repost them as I got them.

Many thanks for your help, Scott.

 

Presumably you have decided to display a bogus IP here instead of a real
IP.

Presumably you have decided to display bogus IPs here instead of the
real IP.

Presumably your brain is vibrating/vibing inside your head instead of
not vibrating/vibing.

What are we supposed to do with bogus IPs?

 

Your site, you mean the shopping cart application hosted on your service
provider?

You have checked the email headers to see if the sender / originating IP
matches a server you know is valid?

Same person, so this is them telling you something rather than the
administration side of the ordering process sending a email?

Not important.

Of course you mention the 99 cents, while at the same time didn't
mention - shopping cart software or the versions / source of the scripts
/ provider try www.google.com first.

That's -

OrgName: eBay, Inc
OrgID: EBAY
Address: 2145 Hamilton Ave
City: San Jose
StateProv: CA
PostalCode: 95008
Country: US
NetRange: 66.211.160.0 - 66.211.191.255
CIDR: 66.211.160.0/19
NetName: EBAY-2
NetHandle: NET-66-211-160-0-1
Parent: NET-66-0-0-0-0
NetType: Direct Assignment
NameServer: SJC-DNS1.EBAYDNS.COM
NameServer: SJC-DNS2.EBAYDNS.COM
NameServer: SMF-DNS1.EBAYDNS.COM
NameServer: SMF-DNS2.EBAYDNS.COM
Comment:
RegDate: 2006-01-25
Updated: 2006-01-25
OrgTechHandle: EBAYN-ARIN
OrgTechName: eBay Network
OrgTechPhone: +1-408-376-7400
OrgTechEmail: network<edited email addy removed the at>ebay.com
# ARIN WHOIS database, last updated 2007-07-17 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.
OrgName: eBay, Inc

at least that looks okay.

Ebay

, 66.212.168.97
An ISP
Pathway Communications
105 Commerce Valley Dr W
Suite 500
Markham, Ontario L3T 7W3
CA
Domain name: PATHCOM.COM

, 215.113.188.35
Seems odd, for paypal

OrgName: DoD Network Information Center
OrgID: DNIC
Address: 3990 E. Broad Street
City: Columbus
StateProv: OH
PostalCode: 43218
Country: US
NetRange: 215.0.0.0 - 215.255.255.255
CIDR: 215.0.0.0/8
NetName: DDN-NIC16
NetHandle: NET-215-0-0-0-1
Parent:
NetType: Direct Allocation
NameServer: CON1R.NIPR.MIL
NameServer: CON2R.NIPR.MIL
NameServer: EUR1R.NIPR.MIL
NameServer: EUR2R.NIPR.MIL
NameServer: PAC1R.NIPR.MIL
NameServer: PAC2R.NIPR.MIL
Comment:
RegDate: 1998-06-05
Updated: 2006-04-11
OrgTechHandle: MIL-HSTMST-ARIN
OrgTechName: Network DoD
OrgTechPhone: +1-800-365-3642
OrgTechEmail: HOSTMASTER<removed the at>nic.mil
# ARIN WHOIS database, last updated 2007-07-17 19:10


, 216.114.188.65

OrgName: SoVerNet, Inc.
OrgID: SOVR
Address: 5 Rockingham Street
City: Bellows Falls
StateProv: VT
PostalCode: 05101
Country: US
NetRange: 216.114.128.0 - 216.114.191.255
CIDR: 216.114.128.0/18
NetName: SOVER-NET-3
NetHandle: NET-216-114-128-0-1
Parent: NET-216-0-0-0-0
NetType: Direct Allocation
NameServer: CLOVER.SOVER.NET
NameServer: APPLE.SOVER.NET
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate: 2000-06-20
Updated: 2004-03-09
RTechHandle: NA22-ORG-ARIN
RTechName: SoVerNet, Inc.
RTechPhone: +1-802-463-2111
RTechEmail: noc<removed at>sover.net
OrgTechHandle: NOC1523-ARIN
OrgTechName: Network Operations Center
OrgTechPhone: +1-802-463-2111
OrgTechEmail: noc<removed at>sover.net
# ARIN WHOIS database, last updated 2007-07-17 19:10
# Enter ? for additional hints on searching ARIN's WHOIS dat

Means nothing unless you have access to the ordering system. In that
case you confirmed this order id.

If you had changed or did then tracing them is pointless in case was was
a known problem site.

Here is some help, www.google.com , OTOH ask the company that processes
your payments.

Web Results 1 - 10 of about 477,000 English pages for
Error code 506. Possible fraud. . (0.10 seconds)

VirtueMart: Your free e-commerce solution. - Error code 506 ...
Error code 506. Possible fraud. Error with REMOTE IP ADDRESS =
172.19.56.161. The remote address of the script posting to this notify
script does not match ...
http://virtuemart.net/index.php?option=com_smf&Itemid=71&?topic=25192.msg87421;topicseen
- 66k - 17 Jul 2007 - Cached - Similar pages

VirtueMart: Your free e-commerce solution. - Error Code 506 and ...
+ Error Code 506 and new Paypal IP - completely lost, please help. ... I
GET AN 'ERROR 506' MESSAGE - 'POSSIBLE FRAUD' - THE PAYMENT GOES
THROUGH, ...
http://virtuemart.net/index.php?option=com_smf&Itemid=71&topic=30001.0;prev_next=next
- 56k - Cached - Similar pages
[ More results from virtuemart.net ]

online marketing, search engine optimization, joomla, multi ...
With the following message: Error code 506. Possible fraud. Error with
REMOTE IP ADDRESS = 216.xxx.xxx.xxx. The remote address of the script
posting to this ...
www.sangriastudios.com/content/blogcategory/27/49/ - 17k - Cached -
Similar pages


PayPal UK - PayPal Developer Community
This is a thread with new unread messages, Error code 506 Possible
fraud. Error with REMOTE IP ADDRESS, 1, AGrant · 10-18-2006 02:25 AM by
PayPal_DannyB ...
www.pdncommunity.com/pdn/board?board.id=uk&page=5 - 62k - Cached -
Similar pages



Me

 

Forgive me, Mike. I've totally lost control of the website. AND the only
thing I know about IP's is what I do in the middle of the night.

Is there a confidentialty issue with IP's, or is it ok to repost the real
ones? If I post the real ones what happens? I already know the guy lives in
Florida, because that's where he says he lives.

 

Yes I changed the numbers around a bit genius me.

 

On Thu, 19 Jul 2007 00:23:03 -0400, Wereo_SUPREME43 wrote:

Are you really that dense still?

a) Bottom posting 1 line after not snipping anything?
What is the point of copying 193 lines adding only 1.

b) I need help, need to know if there is aproblem but I changed the
conditions of the test first.

c) Didn't even comment on any other remarks.

d) Not genius you.

Me

 

Then you engage the forces of law and order. Skipping over the posting
addresses in a public news group.

Me

 

Yeah, and if I told you that I lived in your ass, would you believe me?

I already know the guy lives in

--
Thanks,
Bryan K

To reply, remove .com
** PROUD USER OF THUNDERBIRD **